Anthropic's Mythos 5.2 model is being integrated into enterprise security products from Cisco and IBM via API-only access — customers gain vulnerability discovery capability without receiving model weights. Embedding a frontier bug-hunting model into major enterprise platforms accelerates AI-assisted vulnerability discovery at enterprise scale.

Attackers exploited Railway infrastructure vulnerabilities to steal customer authentication secrets and generate $740,000 in fraudulent AI usage charges, potentially exposing credentials for up to 100,000 workspaces. LLMJacking via cloud infrastructure compromise is now a financially motivated attack category with large-scale credential blast radius.

SAP documented AI-generated phishing, automated spear-phishing, and BEC campaigns targeting African enterprises, alongside frontier model capability to identify vulnerabilities and develop exploits. Resource-constrained regional defenders face industrialized attack production at a scale traditional controls were not designed to absorb.

Google expanded Gemini 4 Carbon access to paying developers following an initial release to cybersecurity defenders. DeepMind used Carbon-based agents to formally verify the libsignal library's post-quantum handshake and Triple Ratchet protocol, establishing a precedent for AI-driven formal verification of security-critical code.

Microsoft's AI-powered vulnerability research system found a memory-safety flaw in Rust's standard library that manual review missed for nearly 11 years. The finding challenges the assumption that Rust's safety model eliminates whole vulnerability classes and demonstrates AI-assisted analysis is effective against carefully engineered codebases.

Researchers rebuilt functional source code for Slack, Apple's Finder, and the TinyTurla-NG malware sample using AI agents operating only from shipped binaries. The rebuilt Slack was functional enough to support new feature development. This collapses the skill barrier for both malware analysis and software exploitation research.

A default behavior in Claude Code causes files containing credentials and sensitive data to be committed to public Git repositories. Traditional secret-scanning may not intercept AI-generated commits before exposure. Organizations deploying AI coding agents in any environment with repository access need explicit guardrails and secret-scanning configured as a hard block.

Frontier AI models with meaningful offensive security capability are no longer hypothetical — Anthropic's Mythos 5.2 ships with demonstrably improved vulnerability discovery and a measurably lower sandbox-escape rate, signaling that the capability-safety tradeoff is now being engineered at the model tier level rather than managed purely through policy ^[1].

AI infrastructure companies are now simultaneously targeted by supply-chain actors and financially motivated LLMJacking crews — Fireworks AI's expanded disclosure shows these are not the same threat, and defending against one does not cover the other ^[1].

Modifying fewer than 10 neurons in an AI model's weights is sufficient to implant a dormant, trigger-activated payload — and the compromised model will pass standard evaluations without raising flags ^[1].

Sustained attacks against open AI platforms are creating pressure to tighten access controls in ways that would fundamentally alter the ecosystem's defining characteristic: openness ^[1].

Australia has accepted 18 recommendations from a rapid review of an OpenAI-related breach affecting government websites — formally treating AI incidents as cybersecurity and governance events requiring structured reporting and accountability, not voluntary disclosure.

An attacker exploited a remote code execution vulnerability in SGLang — a widely deployed open-source AI inference engine — to compromise a NEAR AI production server, exposing sensitive user data and model interactions ^[1].

The prohibitive economics of formal verification — long limiting mathematical security proofs to narrow, high-stakes primitives — have just been fundamentally disrupted.

Week 45's threat intelligence snapshot captures a meaningful inflection point: agentic offensive tooling is no longer augmenting individual attack phases — it is stitching them into continuous, automated kill chains ^[1].